zimage

使用 Z-Image 轻量级文生图接口生成图片。适用于用户要求“生成图片”“海报图”“封面图”“带中文文字的图片”，或直接说比例如 1:1、16:9、9:16 时。将用户的比例要求转换为 size 参数，按用户要求的数量精确执行且不得重复执行。调用接口 zImage，参数含 prompt（必填）与 size（可选...

Before installing or using this skill: 1) Verify and trust the external endpoint (https://agent.mathmind.cn) — confirm that this is the intended API host for the key obtained from kexiangai.com; the mismatch between the key-provider domain and API endpoint is unusual and worth confirming with the skill author or provider. 2) Expect the skill to require an API key (X_API_KEY) despite the registry metadata saying none — do not provide highly privileged or long-lived credentials unless you trust the service. 3) The skill will persist the key in ~/.config/z-image/.env (permission 600) — if you prefer not to store keys on disk, provide the key per-session or use a limited-scope key. 4) Prompts and images are sent to the external API; avoid sending sensitive PII or confidential prompts. 5) If you need higher assurance, ask the author to: (a) correct the registry metadata to declare X_API_KEY as a required credential, (b) explain why the key issuer domain differs from the API host, and (c) optionally support in-memory/session-only keys instead of writing to disk. If you cannot validate those points, proceed cautiously (e.g., test with an expendable key).

Type: OpenClaw Skill Name: zimage Version: 1.0.0 The skill contains shell injection vulnerabilities due to improper input sanitization in `scripts/set_key.sh` and `scripts/generate.sh`. Specifically, `set_key.sh` writes the user-provided API key directly into a configuration file (`~/.config/z-image/.env`) which is later sourced as a shell script by `generate.sh`, allowing for arbitrary command execution if a malicious key is provided. Additionally, `generate.sh` manually constructs JSON payloads using shell variables with inadequate escaping, creating a risk of JSON injection.